Whochoo Privacy Policy

Whochoo Privacy Policy

madeinlemon (hereinafter referred to as the 'Company') establishes and discloses the following Privacy Policy to protect the personal information of data subjects in accordance with the Personal Information Protection Act and to ensure that related grievances are handled promptly and smoothly.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those listed below. Should the purpose of use change, the Company will take necessary measures, such as obtaining separate consent in accordance with the Personal Information Protection Act.

1. Service provision and contract fulfillment, marketing and advertising utilization, demographic analysis, event and activity notifications, service improvement and new service development

Article 2 (Processing and Retention Period of Personal Information)

The Company processes and retains personal information within the period permitted by law or within the period agreed upon by the data subject at the time of collection.

1. Membership registration and management: Until membership withdrawal

2. Provision of goods or services: Until service supply is completed and, for paid services, until payment and settlement are completed

3. Periods prescribed by law

Article 3 (Items and Methods of Personal Information Collection)

The Company collects the following personal information to provide services. To protect children's rights, individuals under the age of 14 are not permitted to register.

1. Items Collected Upon Service Registration

A. Account Information

Email address, name, date of birth, password, address, mobile phone number, business name, country, language, business registration number, business registration certificate, trade business license number, trade business license, profile image, whether the user is a business representative
Optional: Company name

2. Information from Third-Party Sources

The following information may be collected from third-party services.

A. Social Networking Service (SNS) Login

Users can authenticate their identity through third-party services such as Google, Apple, or Facebook, which may result in the provision of personal data to facilitate account creation.

B. Applicable SNS

KakaoTalk, Naver, Google, Apple, Facebook

C. Personal Information Collected

Required items: Name, contact information, email
Optional items: Profile image

3. Automatically Collected Items

Service usage records to prevent unauthorized "member" access, prohibit abnormal use, and ensure smooth service provision; records of improper usage

Article 4 (Provision of Personal Information to Third Parties)

The Company shall process the personal information of data subjects only within the scope specified in Article 1 (Purpose of Processing Personal Information). The Company shall provide personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under special provisions of law. When providing information to third parties, the Company shall notify members in advance and obtain their consent. Members may consent to or refuse the provision of their personal information to third parties.

Payment information collected through the online payment gateway provider's (hereinafter "PG provider") system during service purchase is information collected and managed by the respective PG provider, not by the Company. Therefore, it does not constitute third-party provided information. The responsibility for obtaining consent for its collection and processing lies with the respective payment gateway provider. The PG providers currently operating within the service are as follows.

Payment Gateway (PG)	Business Details
Inicis	Payment processing
PayPal	Payment processing

Article 5 (Entrustment of Personal Information Processing)

The Company does not currently outsource the processing of personal information to external parties, except for server operations necessary for service operation. Should the need for outsourcing arise in the future, the Company will notify data subjects regarding the outsourcing recipient and the details of the outsourced tasks, and obtain prior consent where necessary.

Entrusted Party	Scope of Outsourced Tasks
Amazon Web Services, Inc.	Information storage

Article 6 (Rights of the Data Subject)

1. Members may withdraw all or part of their consent to the Company's use of personal information for service provision and its provision to third parties at any time. In such cases, the Company shall immediately destroy the collected personal information and records confirming its provision.

2. Members may request the Company to temporarily suspend the collection, use, or provision of their personal information at any time, and the Company may not refuse such a request.

3. Members may request the Company to provide access to or notification of the information listed below, and may request correction if such information contains errors. In such cases, the Company may not refuse the member's request without justifiable grounds.

a. Confirmation materials regarding the collection, use, and provision of the member's personal information
b. The reason and content for which the member's personal information was provided to a third party pursuant to the Personal Information Protection and Use Act or other legal provisions

4. Members must comply with the Company's prescribed procedures to exercise the rights set forth in paragraphs 1 through 3.

Article 7 (Retention and Use Period of Personal Information, Destruction Procedures, and Destruction Methods)

1. While a member uses the service, the Company will continue to retain the member's personal information and use it to ensure the smooth provision of the service. However, if a member withdraws their membership or requests termination of their subscription, or if the purpose for which the personal information was provided has been achieved, the collected personal information will be completely deleted from servers and hard disks using methods that prevent recovery and will be processed so that it cannot be accessed or used for any purpose. However, in cases stipulated by relevant laws and regulations, such as the Act on Consumer Protection in Electronic Commerce, the Company will retain the member's information for a certain period as prescribed by law, limited to the following four items, even after the member's service use and withdrawal.

Category	Retention Period
a. Records related to labeling and advertising	6 months
b. Records related to contracts or withdrawal of subscription	5 years
c. Records concerning payment settlement and supply of goods	5 years
d. Records related to consumer complaints or dispute resolution	3 years

2. Destruction Procedure: The Company selects personal information for which a destruction reason has occurred and destroys it upon approval by the Company's Personal Information Protection Officer.

3. Destruction Method: Personal information recorded and stored in electronic file format shall be destroyed in a manner that prevents its reproduction. Personal information recorded and stored on paper documents shall be destroyed by shredding or incineration.

Article 8 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Administrative Measures: Establishing and implementing internal management plans, conducting regular employee training, and so forth

2. Technical Measures: Managing access rights to personal information processing systems, installing access control systems, encrypting unique identifiers, and installing security programs

3. Physical Measures: Access control for computer rooms, data storage rooms, and similar facilities

Article 9 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

The Company uses 'cookies' to store and periodically retrieve usage information in order to provide users with personalized services. Cookies are small pieces of information sent by the server operating the website to the user's browser and may also be stored on the user's computer hard disk.

1. Purpose of Cookie Use: Cookies are used to identify the services and websites visited by the user, their visit and usage patterns, popular search terms, and whether a secure connection is used, in order to provide the user with optimized information.

2. Cookie Installation, Operation, and Refusal: You can refuse cookie storage by adjusting the options in the Tools > Internet Options > Privacy menu at the top of your web browser.

3. Refusing to store cookies may cause difficulties in using customized services.

Article 10 (Personal Information Protection Officer)

The Company designates a Personal Information Protection Officer to oversee all matters related to personal information processing, handle complaints from data subjects, and provide remedies for damages.

Item	Information
Name	Kim Sungmin (Team Leader)
Contact	team@madeinlemon.com

Article 11 (Rights and Obligations of Members)

1. Members must accurately input their personal information to keep it up-to-date and prevent unforeseen accidents. The member bears responsibility for any accidents arising from inaccurate information they input. Inputting false information, such as misusing another person's information, may result in loss of membership status.

2. Members have the right to have their personal information protected, along with the obligation to protect themselves and not infringe upon others' information. Members must exercise caution to prevent the leakage of personal information, including passwords, and must be mindful not to damage others' personal information, including posts. If a member fails to fulfill these responsibilities and damages another person's information or dignity, they may be subject to punishment under the 'Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.' and other applicable laws.

3. Should the Company become aware that another person's name, mobile phone number, or other personal information has been misused for membership registration, the Company shall take necessary measures immediately regarding the relevant account.

Article 12 (Request for Access to Personal Information)

Data subjects may submit requests to access their personal information pursuant to Article 35 of the Personal Information Protection Act of the Republic of Korea to the department listed below. The Company will endeavor to process data subjects' requests for access to their personal information promptly.

Item	Information
Department Name	Customer Center
Contact Person	Minho Seo
Contact	team@madeinlemon.com

Article 13 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Reporting Center, and similar organizations to receive relief for personal information infringements. For other reports or consultations regarding personal information infringements, please contact the following institutions.

Organization	Contact Number	Website
Personal Information Dispute Mediation Committee	1833-6972	www.kopico.go.kr
Personal Information Infringement Reporting Center	118	privacy.kisa.or.kr
Supreme Prosecutors' Office	1301	www.spo.go.kr
National Police Agency	182	ecrm.cyber.go.kr

Article 14 (Notification of Personal Information Leakage)

In the event of a personal information leak, the Company shall promptly notify the relevant data subject of the fact and report it to the relevant authorities in accordance with Article 34 of the Personal Information Protection Act.

Article 15 (Application of the Personal Information Processing Policy)

This Privacy Policy shall be effective as of February 1, 2026.